Buggy code:
public class XMLDTDScannerImpl extends XMLScanner implements XMLEntityHandler , XMLComponent , XMLDTDScanner { protected static final int SCANNER_STATE_END_OF_INPUT = 0 ; protected static final int SCANNER_STATE_TEXT_DECL = 1 ; protected static final int SCANNER_STATE_MARKUP_DECL = 2 ; private static final String [ ] RECOGNIZED_FEATURES = new String [ ] { VALIDATION , NOTIFY_CHAR_REFS } ; private static final Boolean [ ] FEATURE_DEFAULTS = new Boolean [ ] { null , Boolean . FALSE } ; private static final String [ ] RECOGNIZED_PROPERTIES = new String [ ] { SYMBOL_TABLE , ERROR_REPORTER , ENTITY_MANAGER } ; private static final Object [ ] PROPERTY_DEFAULTS = new Object [ ] { null , null , null } ; private static final boolean DEBUG_SCANNER_STATE = false ; protected XMLDTDHandler fDTDHandler ; protected XMLDTDContentModelHandler fDTDContentModelHandler ; protected int fScannerState ; protected boolean fStandalone ; protected boolean fSeenExternalDTD ; protected boolean fSeenExternalPE ; private boolean fStartDTDCalled ; private XMLAttributesImpl fAttributes = new XMLAttributesImpl ( ) ; private int [ ] fContentStack = new int [ 5 ] ; private int fContentDepth ; private int [ ] fPEStack = new int [ 5 ] ; private boolean [ ] fPEReport = new boolean [ 5 ] ; private int fPEDepth ; private int fMarkUpDepth ; private int fExtEntityDepth ; private int fIncludeSectDepth ; private String [ ] fStrings = new String [ 3 ] ; private XMLString fString = new XMLString ( ) ; private XMLStringBuffer fStringBuffer = new XMLStringBuffer ( ) ; private XMLStringBuffer fStringBuffer2 = new XMLStringBuffer ( ) ; private XMLString fLiteral = new XMLString ( ) ; private XMLString fLiteral2 = new XMLString ( ) ; private String [ ] fEnumeration = new String [ 5 ] ; private int fEnumerationCount ; private XMLStringBuffer fIgnoreConditionalBuffer = new XMLStringBuffer ( 128 ) ; public XMLDTDScannerImpl ( ) { } public XMLDTDScannerImpl ( SymbolTable symbolTable , XMLErrorReporter errorReporter , XMLEntityManager entityManager ) { } public void setInputSource ( XMLInputSource inputSource ) throws IOException { } public boolean scanDTDExternalSubset ( boolean complete ) throws IOException , XNIException { } public boolean scanDTDInternalSubset ( boolean complete , boolean standalone , boolean hasExternalSubset ) throws IOException , XNIException { } public void reset ( XMLComponentManager componentManager ) throws XMLConfigurationException { } public void reset ( ) { } public String [ ] getRecognizedFeatures ( ) { } public String [ ] getRecognizedProperties ( ) { } public Boolean getFeatureDefault ( String featureId ) { } public Object getPropertyDefault ( String propertyId ) { } public void setDTDHandler ( XMLDTDHandler dtdHandler ) { } public XMLDTDHandler getDTDHandler ( ) { } public void setDTDContentModelHandler ( XMLDTDContentModelHandler dtdContentModelHandler ) { } public XMLDTDContentModelHandler getDTDContentModelHandler ( ) { } public void startEntity ( String name , XMLResourceIdentifier identifier , String encoding ) throws XNIException { } public void endEntity ( String name ) throws XNIException { } protected final void setScannerState ( int state ) { } private static String getScannerStateName ( int state ) { } protected final boolean scanningInternalSubset ( ) { } protected void startPE ( String name , boolean literal ) throws IOException , XNIException { } protected final boolean scanTextDecl ( ) throws IOException , XNIException { } protected final void scanPIData ( String target , XMLString data ) throws IOException , XNIException { } protected final void scanComment ( ) throws IOException , XNIException { } protected final void scanElementDecl ( ) throws IOException , XNIException { } private final void scanMixed ( String elName ) throws IOException , XNIException { } private final void scanChildren ( String elName ) throws IOException , XNIException { } protected final void scanAttlistDecl ( ) throws IOException , XNIException { } private final String scanAttType ( String elName , String atName ) throws IOException , XNIException { } protected final String scanAttDefaultDecl ( String elName , String atName , String type , XMLString defaultVal , XMLString nonNormalizedDefaultVal ) throws IOException , XNIException { String defaultType = null ; fString . clear ( ) ; defaultVal . clear ( ) ; if ( fEntityScanner . skipString ( "#REQUIRED" ) ) { defaultType = "#REQUIRED" ; } else if ( fEntityScanner . skipString ( "#IMPLIED" ) ) { defaultType = "#IMPLIED" ; } else { if ( fEntityScanner . skipString ( "#FIXED" ) ) { defaultType = "#FIXED" ; if ( ! ( skipSeparator ( true , ( ! ( scanningInternalSubset ( ) ) ) ) ) ) { reportFatalError ( "MSG_SPACE_REQUIRED_AFTER_FIXED_IN_DEFAULTDECL" , new Object [ ] { elName , atName } ) ; } } boolean isVC = ( ! ( fStandalone ) ) && ( ( fSeenExternalDTD ) || ( fSeenExternalPE ) ) ; <START_BUG> scanAttributeValue ( defaultVal , nonNormalizedDefaultVal , atName , fAttributes , 0 , isVC ) ; <END_BUG> } return defaultType ; } private final void scanEntityDecl ( ) throws IOException , XNIException { } protected final void scanEntityValue ( XMLString value , XMLString nonNormalizedValue ) throws IOException , XNIException { } private final void scanNotationDecl ( ) throws IOException , XNIException { } private final void scanConditionalSect ( int currPEDepth ) throws IOException , XNIException { } protected final boolean scanDecls ( boolean complete ) throws IOException , XNIException { } private boolean skipSeparator ( boolean spaceRequired , boolean lookForPERefs ) throws IOException , XNIException { } private final void pushContentStack ( int c ) { } private final int popContentStack ( ) { } private final void pushPEStack ( int depth , boolean report ) { } private final int popPEStack ( ) { } private final boolean peekReportEntity ( ) { } private final void ensureEnumerationSize ( int size ) { } private void init ( ) { } }

Fix:
scanAttributeValue ( defaultVal , nonNormalizedDefaultVal , atName , fAttributes , 0 , isVC , elName ) ;